Privacy notice

This Privacy Notice applies to you if you are:

• A visitor to our website or a user of the Capitec app or digital channels
• A prospective client who has applied to use our products and services, either directly with us or through one of our partners
• A prospective client who has downloaded the Capitec app, with the intention of exploring or taking up our products and services
• An existing client who uses our products and services
• An existing or potential employee of the Capitec Group, including its subsidiaries
• A natural or juristic person whose personal information we process when you provide us with products and services, for example, contractors or authorised agents, vendors, approved partners or suppliers
• A natural or juristic person whose personal information you have shared with us for the purposes of taking up or using a product or service
• A natural or juristic person whose personal information is provided or obtained on your behalf, for the purposes of taking up or using a product or service. This may include individuals who are linked to you or your entity, such as your spouse, dependants, beneficiaries, lives assured, directors, members, partners, trustees, ultimate beneficial owners, nominated representatives, authorised signatories, guarantors, co-applicants for home loan applications/enquiries, members of a stokvel or similar arrangement, or any other persons whose personal information is submitted or obtained in relation to a product or service we offer
• A natural or juristic person whose personal information was shared with us by an authorised agent, intermediary or person for the purposes of taking up or using a product or service e.g. your spouse, dependants, beneficiaries, directors, members, partners, ultimate beneficial owners, nominated representatives, authorised signatories, lives assured, members of a stokvel, intermediaries, agents or other third parties details provided, where applicable
• A natural or juristic person whose personal information you have provided to us for the delivery of products e.g. vehicle licence documents or electronic devices
• A natural person whose personal information we process during the Capitec Financial Education programmes
• A natural or juristic person whose personal information we may have obtained from third-party service providers or publicly available, government or official sources (such as public records or social media where information has been lawfully made public)
• A visitor at our branches, ATMs or operational areas

Personal information means information, in any format, which can identify a living natural person or, where applicable, a juristic person.

Personal information excludes:

• Statistical information: De-identified information that we collect and compile for statistical purposes
• Aggregate information: Information in aggregated form that does not identify you
• De-identified information: Information that has been permanently altered to remove any identifiable information so that it cannot be traced back to you

We will collect your personal information under these circumstances or conditions:

• You visit our website or use the Capitec app or digital channels
• You register on the Capitec app as a guest user or existing client
• You or a person on your behalf or connected to you apply for a bank account, take out an insurance policy or use any of the Capitec Group products or services
• You register to use Capitec’s MoneyUp Academy
• We communicate with you and act on your instructions when you contact us by phone, WhatsApp, email or social media or any other communication channel used by us
• You voluntarily supply us with optional information for example, email addresses, opinions or alternative contact details
• When you perform transactions on your account we will collect your transaction history and transacting activities
• You use our products and services or engage with us and we establish personal preferences or behavioural trends about you
• At the time of visiting any of our branches, ATMs or operational areas
• When you are required to verify your identity during onboarding, login, or when performing certain transactions, including through selfie-based identity verification or digital identity verification (such as Smart ID)
• When we obtain information about you from third-party service providers or publicly available, government or official sources (including but not limited to the CIPC or any publicly available database), where permitted by law and for lawful purposes
• When we acquire additional information from third parties or any legally recognised sources or databases to verify the information provided by you or for fraud detection and prevention processes

Each Capitec Group entity may also collect your personal information from other entities within the Capitec Group or from partners or affiliates of Capitec with whom the Capitec Group conducts business.

When you provide us with the personal information of other people (like your spouse, dependants, beneficiaries, lives assured, directors, members, partners, trustees, ultimate beneficial owners, nominated representatives, authorised signatories, guarantors, dependents, beneficiaries, lives assured, co-applicants for home loan applications/enquiries, or members of a stokvel or similar arrangement), you confirm that you have their permission, where applicable, to share this information with us for the purposes outlined in this Privacy Notice. You also agree to indemnify us from any loss or damage that might occur if you share or instruct us to obtain a third party’s information without the necessary consent or proper authorisation.

If you have an employment application, we may gather additional information about you from various sources. This could include public records, career platforms, social media and other third parties. For instance, we might obtain insights from your professional or academic references, such as previous employers or educational institutions, as well as through third-party pre-employment background checks.

We may process your personal information together with third parties who assist us or where we jointly determine how your information is used, in line with applicable data protection laws.

We will only collect your information in line with relevant regulations and laws. The information we collect, and process could include:

• Personal details, for example, your name and surname, previous names and surnames, gender, date of birth and occupation
• Information concerning your identity, for example, an identification number such as your South African ID number, Passport number or Tax Identification number
• Contact details, for example, your home, work, postal or email addresses and telephone numbers
• Biometric information linked to your account, for example, photographic identification, live selfie images used for identity verification and biometric fingerprint information
• Authentication data generated during facial recognition and identity verification processes, including liveness detection, liveness results and verification outcomes
• Demographic information, for example, your gender and/or marital status
• Credit bureau information, data about you held at a registered credit bureau, including qualification data, contact information and residential information
• Information and documents about the business or entity including, but not limited to, constitutional documents, trust deeds, agreements and financial statements
• Transactional behaviour data, data about how you interact with our products and services and the actions you perform in relation to any Capitec service or product
• User login data, for example, your login credentials for the Capitec app or digital channels
• Location information, the approximate geographic location at the time of using the Capitec app or performing a Capitec transaction
• Other information about you that you give us by filling in forms, surveys, competitions or by communicating with us, whether face-to-face, by telephone, email, online or live chat
• Financial information such as your bank account details
• Identity verification information obtained through digital identity services (such as Smart ID)
• Information obtained from third-party service providers and publicly available, official sources or government sources (such as location-based data or company and registration information)

Depending on the products and services that you require, we may also collect special personal information about you, for example:

• Demographic information, for example, your race or ethnicity
• Criminal information, for example, information about your commission or alleged commission of any criminal offence or about any related legal proceedings
• Health-related data including but not limited to your medical history for insurance and product related services
• Personal information of children under the age of 18, whose information is provided to us by a legal guardian or competent person to open a bank account, as an insurance product beneficiary, a Capitec bursary recipient, or part of the Financial Education programmes, including MoneyUp Academy. Where we process personal information of children, this is subject to additional protections and legal restrictions due to the vulnerability of children

Depending on the products and services that you use, we may also collect or generate the following information about you:

• Information about you or those you represent, their relationship with us, the channels you use and your ways of interacting with us, including the Capitec app or digital channels, as well as information concerning complaints, disputes and insurance claims
• Life insurance and non-life insurance information related to policy content for yourself and your beneficiaries, claims information, previous policy and claims information and information that confirms if you have passed away, to enable us to pay out insurance benefits to your beneficiaries
• For managing and administering stokvel bank accounts, information such as name, surname, ID number and member details may be collected, along with due diligence data including anti-money laundering (AML) checks and fraud monitoring records
• Information required for home loan applications/enquiries, which is collected and processed collaboratively between us, and the home loan assessor or provider. This may include, but is not limited to, personal and financial details, employment information, property-related documents, and any other supporting information and materials necessary to facilitate the assessment and approval of your home loan application, in line with our broader collection of personal and financial information as outlined in this notice
• Cookies, and similar technologies we use to recognise you, remember your preferences and tailor the content we provide to you. Our cookie policy, available at Cookie Policy | Privacy Centre | Capitec , contains more details about how we use cookies
• Investigation data, for example, due diligence checks, fraud, sanctions and anti-money laundering checks, external intelligence reports, content and metadata related to relevant exchanges of information between and among individuals and organisations, including emails, voicemails and live chat
• Records of correspondence and other communications between us, including emails, telephone conversations, live chat, instant messages and social media communications
• Information that we require to support our regulatory obligations, for example, information about transaction details, purpose of payment, counterparty/beneficiary information, identification documents, detection of any suspicious and unusual activity and information about parties connected to you or these activities
• Information about the devices you use to access the Capitec app, digital channels or website, for example, software and Internet Protocol (“IP”) address
• We collect data and information (through third-party products) on your device called ‘Log Data’ for Merchant Services and Capitec Connect products. This Log Data may include information such as your device's IP address, Device model, Device name, Device ID, operating system version, NFC functionality, the configuration of the Capitec app, the time and date of your use of this Service and other statistical information
• International Mobile Equipment Identity (‘IMEI’) Number to provide Capitec Connect services such as Subscriber Identification Module (‘SIM’) Swap, SIM Ownership Charge, Number Churn and Porting Services Support
• Employment information such as status and remuneration when you take out a credit product with us, for a retrenchment claim or medical and other information for when we assess a lump sum disability or temporary disability claim
• Education, lifestyle, and financial health information, which you may provide to us when you join Capitec’s MoneyUp Academy
• Insights and analytics derived from your use of our products and services, which will be aggregated or de-identified

Our personal information core processing principles are explained in detail here.

If we are unable to collect your personal information, or you request that we restrict the processing of your personal information necessary to provide the products and services you have requested, we regret that we will not be able to continue offering you our products and services.

We only process your personal information for clear purposes, use it in a fair and responsible way, and take steps to protect your privacy. We will only process your personal information where we have a lawful reason for doing so and on a justifiable ground. For example, where you have consented to the processing, where it’s necessary for us to comply with obligations imposed by law, where it’s necessary to perform a contract with you or where it’s necessary to pursue our legitimate interests or those of a third party (as further detailed below). You can exercise your POPIA rights related to this processing at any time here.

The personal information we collect may be processed through centralised functions and systems across entities (including joint ventures and companies) in the Capitec Group. It may be used for the purposes of fraud, risk monitoring and analysis, statistical analysis and to improve, develop, price and market products or services. We may use automated tools, including artificial intelligence, to support our services, security safeguards and fraud prevention techniques. This will be done with the appropriate controls as set out below.

Where we process Special Personal Information, such processing is subject to additional legal restrictions and will only take place where a specific lawful ground applies together with appropriate safeguards.

• Entering into or performance of a contract

Clients and potential clients

We need to process your personal information to carry out the obligations of our agreement with you. This includes all the processing and pre-assessment activities that are required to enable us to sign you up for one or more of our Capitec Group products or services (for example, verifying your identity, pricing all contracts, assessing and verifying claims, assessing whether you qualify for a product or service, enrolling you for electronic signatures, obtaining your credit bureau information etc.), use the Capitec app and managing the client or potential client relationship for the duration of the agreement and as required after termination of the client relationship. We may use information obtained from third-party, public or government sources to support our services, including identity verification, client due diligence, fraud prevention and to maintain accurate and up-to-date information about you.

To use some of our services, we need to confirm that you are in South Africa. This is due to regulatory and App Store requirements. For example, we need your location to let you play Lotto on the Capitec app and to accept payments with our Merchant Device. We also use location services to monitor for fraud and risk. You might need to allow the Capitec app to access your location while using it. We only use your location while you use the Capitec app and do not track your location otherwise.

• Identity verification

We may require additional identity verification where necessary, using biometric or digital methods, such as a selfie or digital identity services (for example, Smart ID), to protect your account, comply with regulatory obligations or provide you with certain services. Where you choose to use services such as Smart ID, we may process your information to facilitate your request and share relevant information with authorised third parties (for example, government authorities or service providers) to complete the service. Your identity verification information is used for security, fraud prevention and service delivery purposes, and is not used for marketing or unrelated activities.

• Client-authorised information sharing

Where you request us to do so, we may provide verified personal information about you (such as proof of identity, proof of account, account statements or proof of address) to third parties for a specific purpose, for example to enable you to meet onboarding or verification requirements with another service provider or public authority.

This is done:

- At your request and with your explicit consent

- For a clearly defined purpose communicated to you at the time

- Using secure and controlled processes

We only share the minimum information necessary to fulfil the request, and the receiving party is responsible for their use of the information.

Employees and potential employees

We need to process your personal information and special personal information to carry out the obligations of our agreement with you as a potential or permanent Capitec employee. We will use the personal information and special personal information collected for recruitment purposes and for purposes connected with your employment. We may seek more information about you from other sources, including from public domains, career platforms, social media and/or third parties.

• Compliance with law and regulatory compliance obligations

We may need to process your personal information and special personal information to comply with specific legal obligations. We operate in a highly regulated environment of banking, insurance, financial services, credit and other goods and services, which means that there are several laws, regulations and directives that require us to perform certain processing activities (such as the FIC Act, the Income Tax Act and the VAT Act).

This may include using your personal information and special personal information to help detect or prevent crime (including terrorism financing, money laundering and other financial crimes). We will only do this on the basis that it’s needed to comply with a legal obligation or it’s in our legitimate interests and/or that of others.

We will mostly collect information directly from you but there may be instances where we may need to obtain your information from the Department of Home Affairs, the Credit Bureaus and other public sources, to:

• Ensure that there are no deficiencies in your information
• Ensure that your information is kept up-to-date and correct
• Determine and manage financial crime risks
• Identify yourself and verify your source of funds or income

We will use the most reliable source of information to update your personal information where required.

• Legitimate interest

We process your personal information to protect your legitimate interests or when necessary to pursue our own or a third party’s legitimate interest. We have processes in place to ensure that your personal information and right to privacy remain protected at all times. This includes the use of risk-based authentication measures, such as biometric or selfie or digital identity verification, where necessary to aim to prevent fraud.

We may use video surveillance in our branches, at our ATMs or operational areas for safety, security and operational efficiency.

• Tracking or recording what you say or do

We may record your interactions with us, such as emails, phone calls, live chats and other communications. These recordings help us to verify your instructions, improve our service, train our staff, manage risks and prevent fraud and other crimes. We may also collect information about the devices or software you use during these interactions.

• Product and service improvement and development

We may use your personal information as a banking and insurance client to personalise existing and new products and services to benefit you. Our analysis includes data analytics, statistical or other analysis to better understand how you use our services and to respond to any service issues you may have. You can opt out of this personal information usage at any time for direct marketing and personalised offers by changing the consent settings and communication preferences on your app or through the Client Care Centre. Alternatively, send us a request on Processing Restriction Request | Privacy Centre | Capitec.

Opting out of direct marketing or personalised offers will only opt you out of product offer communications based on consent and not where the processing of your personal information is necessary when required by law or when required to carry out the obligations of an agreement we have with you. Where the processing of your personal information is required by law or when carrying out the obligations of an agreement, you cannot opt out of this communication.

Where you have consented to us doing so:

• We may analyse the type of transactions you perform to provide you with personalised offers to improve existing and create new products that could benefit you (personalised offers)
• We may send you our latest offers and products through electronic communication (direct marketing)
• We may send you financial educational information to assist you in improving your financial life

These services aim to keep you informed about and offer you new products, services and benefits that help you to live better but also to educate you about good financial behaviours based on your previous actions or needs.

• When we have your explicit consent to further process your personal information
• Where the purpose of the further processing is compatible with the purposes for which your personal information was initially collected
• Where the personal information is available in or derived from a public record or has been deliberately made public
• When further processing is required by law or for legal proceedings
• When processing is needed to protect the public from financial loss due to dishonesty or malpractice
• When the processing is required for statistical purposes

These further processing conditions may be subject to additional restrictions where the personal information is Special Personal Information or Personal Information of children. 

We may share your personal information with third parties. Where we do share your personal information with third parties, we ensure that the correct due diligence is in place, such as appropriate security safeguards and confidentiality obligations. Your information may be shared with third parties in the following instances:

• To provide you with products or services you have requested, e.g., fulfilling a payment request or sharing information with third-party vendors that Capitec uses
• Where Capitec has a public or legal duty to do so, for example, for credit assessments or to assist with detecting and preventing fraud, tax evasion and financial crime
• Where Capitec must do so in connection with regulatory reporting, litigation, governmental audit or asserting or defending legal rights and interests in compliance with legal obligations, for example, if a court order or subpoena directs Capitec to share the information. Capitec may also share your personal information with correspondent banks under its Relationship Management Application (RMA) arrangements as mandated by the Society for Worldwide Interbank Financial Telecommunication (SWIFT) and other similar Scheme, when required to do so for legitimate banking operations or compliance purposes
• Where Capitec has a legitimate business reason for doing so
• Where Capitec is required to do so to either manage risks, verify your identity, provide you with services requested or assess your suitability for products and services
• Where Capitec has asked your permission to share the personal information and this was consented to
• To provide third parties with aggregated or de-identified insights or analytics that do not identify you

We may share your personal information with third parties for the following reasons:

You can exercise your POPIA rights related to the retention of your personal information at any time here, but we may have to keep your personal information even if we no longer have a relationship with you to meet our regulatory requirements and for legitimate business purposes, as set out in our information retention policy. Any retained information will be kept secure in line with our security policies. If we don’t need the information anymore, we may delete it or de-identify it.

We will take the appropriate, reasonable, technical and organisational steps to protect your personal information in line with industry best practices. This includes, e.g.:

• We ensure that known threats are accounted for. We have implemented administrative, technical, personnel and physical measures to protect your personal information against loss, theft, access and unauthorised use or changes
• We have implemented appropriate security controls to prevent the processing of your personal information from being accidentally or deliberately compromised. This includes physical and organisational security measures such as restricted user access, responsible information handling, malware controls, encryption or obfuscation or masking, vulnerability and penetration testing
• We always use secure methods of transfer when storing or sharing your personal information
• Only approved Capitec employees or consultants acting on behalf of Capitec are allowed access to your personal information to perform their daily tasks for Capitec
• We ensure that if we do share your personal information with third parties, the necessary safeguards, written agreements and due diligence are in place to protect your personal information
• We will notify both you and the Information Regulator in the event that we have reasonable grounds to believe that your personal information has been accessed or acquired unlawfully

Your information may be transferred to and stored in locations outside of South Africa. When we do this, we will ensure that the third-party recipient of the information is subject to adequate data protection laws to ensure that your personal information is protected at the level of protection as required in terms of South African data protection laws and that the transfer is lawful.

We will not sell your personal information. We may, however, use aggregated or de-identified information to develop insights, analytics or services, including services provided to third parties, in a way that does not identify you. Personal information will only be disclosed as described in this Privacy Notice or where otherwise permitted or required by law.

You have several rights in relation to the personal information that we hold about you. These rights include:

• The right to request access to the information we hold about you and to obtain information about how we process it
• The right to withdraw your consent to our processing of your information, which you can do at any time. We may continue to process your information if we have another justifiable ground for doing so, although this may impact your ability to continue to have access to our products and services
• The right to request that we correct your information if it’s inaccurate or incomplete
• The right to request that we delete or destroy your information. However, we will retain information that is required for our lawful purposes and within the legally permissible retention period. This means that we may retain some of your information even if you requested us to delete or destroy it
• The right to object to, and to request that we restrict our processing of your information. There may be situations where you object to, or ask us to restrict, the processing of your information but we are entitled to lawfully continue processing your information and/or to refuse your request
• The right to take legal action against us should you believe that we have mishandled your personal information
• The right to be informed by us when your personal information we hold has been accessed or acquired unlawfully
• The right not to be subject to a decision made only based on automated processing of your personal information, which is used to create a profile of you, under certain conditions. While we may use automated tools, including artificial intelligence, to support certain processes, appropriate human oversight and safeguards are applied and decisions are not made solely by automated means where this would significantly affect you. You may request additional information or, where applicable, request a review
• You can exercise your rights in our Privacy Centre by clicking on the following link: Exercise Your POPIA Rights | Privacy Centre (capitecbank.co.za)

You may submit a grievance about the processing of your personal information in relation to this Privacy Notice through our Privacy Centre POPIA / Other Complaint | Privacy Centre | Capitec.

You also have the right to file a complaint with the Information Regulator about an alleged contravention of the protection of your personal information. The contact details of the Information Regulator are as follows:

If we change ownership, merge with, acquire or are acquired by or sell assets to another entity we may assign our rights to the personal information we process to a successor, purchaser or separate entity. We will disclose the transfer on our website. If you are concerned about your personal information being transferred to a new owner, you may exercise your rights in our Privacy Centre by clicking on the following link: Exercise Your POPIA Rights | Privacy Centre (capitecbank.co.za).

We regularly review our practices to make sure your personal information is safe and used responsibly. Sometimes we may need to update our data privacy policies. This may affect clauses in our contracts or terms and conditions. If we do, we’ll let you know by posting a notice on our website or app or through another communication method. These notices will show what changes we made and when they start.

Please note that Capitec may not be able to continue a banking or insurance relationship with a client or provide clients with certain products or services if they object to or do not agree with the changes.

The latest version of this Privacy Notice is dated and made available on Capitec’s website. It applies to all data subject interactions with Capitec and will be accessible on Privacy Notice | Privacy Centre | Capitec.